Security implications of method of question 2 in Exam 2: IV is useless - assuming IV is sent in clear (as is usual), eavesdropper can undo the XOR of it with encrypted plaintext block. (1) Normally IV is used to make same plaintext sent with same key appear to be different, but here, even if IV is changed, an attacker can recognize the same P1, as C1 XOR IV = C1' XOR IV' (1); worse yet, if Pi' = Pi for all i<=j, then Ci'=Ci for all 1i (1). There is little diffusion - a change in Pi makes significant changes in Ci' (as with ECB) (1), but only changes corresponding bits in Ci+1' (1) and nothing after that (1). A serious problem is that if it is known that Pj' = Pi and the same key is used, then Pj-1' XOR Pi-1 = Cj' XOR Ci (2). Undetected cut and paste can also be a problem - let Pi and Qj be plaintext blocks from two messages, and Ci and Dj be the corresponding ciphertext blocks, both encryptions performed with the same key K. If an attacker knows Pi, Pi+1, Pi+2, Ci, Ci+1, Ci+2, Qj, Qj+1, Qj+2, Dj, Dj+1, and Dj+2, then she can substitute a Q2 with P2 without randomizing any blocks, as follows. (3) Dj+1' = Qj XOR Pi XOR Ci+1 Dj+2' = Pi+1 XOR Qj+1 XOR Dj+2. Not really so much on security per se as performance, we can observe that encryption can be done in parallel, since Pi-1 and Pi are all available (1), but decryption must be done serially, as Ci cannot be decrypted until Pi-1 has been obtained (1).